tcpdump basic commands

gistfile1.txt

tcpdump [options] [protocol] [type]

options:  -n   : display no. not names
          -nn  : no. for machine and port
          -i   : sniff particular interface
          -v   : verbose (-vv or -vvv)
          -w   : dump packet to file
          -r   : read packets from file
          -x   : print hex
          -X   : print HEX and ASCII
          -A   : print ASCII
          -s   : snap this many bytes from each packet (-s 0 grabs entire packet)

protocol: ether, ip, ip6, arp, rarp, tcp, udp

type:
    host : packets to and from host
    net : packets to and from network
    port : packets to and from port
    portrange : packets to and from range of ports
    src : packets from this source only
    dst : packets to this dest only
    
# help usage and version
tcpdump -h

# list all interface available for capture
sudo tcpdump -D

# capture packets on pseudo inteface (all interfaces)
sudo tcpdump -i any

# capture 5 packets on pseudo inteface (all interfaces)
sudo tcpdump -i any -c 5

# capture 5 packets on pseudo inteface (all interfaces) displaying ip address and port number instead of hostname and application
sudo tcpdump -i any -c 5 -n

# capture 5 packets on pseudo inteface (all interfaces) displaying ip address and port number instead of hostname and application
# capture size 96 bytes (Ethernet, IP, TCP + part of application)
# -s0 === maximum size
sudo tcpdump -i any -c 5 -n -s96

sudo tcpdump -i any -c20 -n tcp and dst port 49952 -t

# DNS request
sudo tcpdump -i eth0 port 53 -n

# Capture to a file
sudo tcpdump -i any -w capture.pcap -v

# Reading capture file
sudo tcpdump -n -r capture.pcap | less

# Filters
sudo tcpdump -i eth1 -n host 10.0.0.3 -c5
sudo tcpdump -i eth1 -n src host 10.0.0.3 -c5
sudo tcpdump -i eth1 -n host 10.0.0.1 and host 10.0.0.3 -c5
sudo tcpdump -i eth1 -n host 192.168.1.91 and port 80 -c5
sudo tcpdump -i eth0 -n "host 192.168.1.91 and (port 80 or port 443)"
sudo tcpdump -i eth0 -n -c100 "src net 192.168.0.0/16 and not dst net 192.168.0.0/16 and not dst net 10.0.0.0/8"
sudo tcpdump -i eth0 ether host 28:16:2e:1f:25:49 -n -c10
sudo tcpdump -i eth0 ether host 28:16:2e:1f:25:49 -n -c10 -e
sudo tcpdump -i any ip6

# sync flag set
sudo tcpdump -i any "tcp[tcpflags] & tcp-syn != 0"

sudo tcpdump -i any "tcp[tcpflags] & tcp-rst != 0"

# more info with -XX
sudo tcpdump -i eth0 port 80 -c7 -XX
sudo tcpdump -i eth0 port 80 -c7 -A
sudo tcpdump -i eth0 port 80 -c7 -vvv

# quiet option
sudo tcpdump -i eth0 -q

# remove timestamp with -t
sudo tcpdump -i eth0 -t
NOTES:
  Ethernet + IP + TCP header = 64 bytes